@miller-tech/uap 2.1.4 → 2.1.5

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@miller-tech/uap",
-  "version": "2.1.4",
+  "version": "2.1.5",
   "description": "Autonomous AI agent memory system with CLAUDE.md protocol enforcement",
   "type": "module",
   "main": "dist/index.js",
@@ -21,7 +21,7 @@
     "start": "node dist/bin/cli.js",
     "test": "vitest",
     "test:ci": "vitest run",
-    "test:enforcers": "UAP_PROXY_ENV_AUTOLOAD=0 python3 -m unittest tools.agents.tests.test_enforcement_self_protect tools.agents.tests.test_conditional_destructive_verbs tools.agents.tests.test_live_deliver_kill tools.agents.tests.test_schema_diff_gate tools.agents.tests.test_schema_diff_inline tools.agents.tests.test_stream_telemetry tools.agents.tests.test_project_telemetry_events tools.agents.tests.test_workdir_scope_enforcer tools.agents.tests.test_gate_evidence tools.agents.tests.test_repeat_call_guard tools.agents.tests.test_repeat_guard tools.agents.tests.test_gate_integrity tools.agents.tests.test_gate_failclosed_indirection tools.agents.tests.test_gate_failclosed_schema_diff tools.agents.tests.test_expert_review_pr_scope tools.agents.tests.test_path_containment tools.agents.tests.test_path_normalizer_hardened tools.agents.tests.test_sandbox_tool_strip tools.agents.tests.test_proxy_env_loader tools.agents.tests.test_stream_required_tool tools.agents.tests.test_tool_call_wrapper_profiles tools.agents.tests.test_tool_convert_cache tools.agents.tests.test_doubling_break tools.agents.tests.test_error_loop_ignores_correctives tools.agents.tests.test_attractor_detection tools.agents.tests.test_client_disconnect tools.agents.tests.test_confidence_escalation tools.agents.tests.test_coordination_ban tools.agents.tests.test_coordination_early_ban tools.agents.tests.test_cycle_break_exploration tools.agents.tests.test_deferral_break tools.agents.tests.test_deliver_autoroute tools.agents.tests.test_delivery_enforcement_all_langs tools.agents.tests.test_delivery_enforcement_exemptions tools.agents.tests.test_delivery_enforcement_filepath tools.agents.tests.test_delivery_enforcement_write_complexity tools.agents.tests.test_fastpath_config tools.agents.tests.test_delivery_enforcement_web_and_bash tools.agents.tests.test_disconnect_watcher tools.agents.tests.test_empty_maxtokens_recovery tools.agents.tests.test_empty_tool_loop_break tools.agents.tests.test_enforcer_escape_hatches tools.agents.tests.test_error_loop_break tools.agents.tests.test_finalize_suppression tools.agents.tests.test_malformed_unclosed_think tools.agents.tests.test_mandate_beats_recon tools.agents.tests.test_mandate_deliver tools.agents.tests.test_overflow_truncate_count_tokens tools.agents.tests.test_passthrough_oauth tools.agents.tests.test_project_telemetry tools.agents.tests.test_proxy_auth_headers tools.agents.tests.test_prune_preserve_force_write tools.agents.tests.test_recon_deliver_gate tools.agents.tests.test_session_admission tools.agents.tests.test_stream_heartbeat tools.agents.tests.test_stuck_break_reattach tools.agents.tests.test_stuck_break_hard tools.agents.tests.test_turn_count_breaker_periodic tools.agents.tests.test_upstream_chokepoint tools.agents.tests.test_vision_passthrough tools.agents.tests.test_worktree_required tools.agents.tests.test_enforcer_suite_coverage tools.agents.tests.test_validate_plan_gate tools.agents.tests.test_validate_plan_inside_project tools.agents.tests.test_anthropic_proxy_streaming tools.agents.tests.test_non_stream_resp_log tools.agents.tests.test_delivery_enforcement_worktree tools.agents.tests.test_output_token_ceilings tools.agents.tests.test_tool_narrowing_core tools.agents.tests.test_models_context_window tools.agents.tests.test_thinking_template_kwargs tools.agents.tests.test_cycle_break_wait_poll tools.agents.tests.test_upstream_model_aliases tools.agents.tests.test_stream_thinking_deltas",
+    "test:enforcers": "UAP_PROXY_ENV_AUTOLOAD=0 python3 -m unittest tools.agents.tests.test_enforcement_self_protect tools.agents.tests.test_conditional_destructive_verbs tools.agents.tests.test_live_deliver_kill tools.agents.tests.test_schema_diff_gate tools.agents.tests.test_schema_diff_inline tools.agents.tests.test_stream_telemetry tools.agents.tests.test_project_telemetry_events tools.agents.tests.test_workdir_scope_enforcer tools.agents.tests.test_gate_evidence tools.agents.tests.test_repeat_call_guard tools.agents.tests.test_repeat_guard tools.agents.tests.test_gate_integrity tools.agents.tests.test_gate_failclosed_indirection tools.agents.tests.test_gate_failclosed_schema_diff tools.agents.tests.test_expert_review_pr_scope tools.agents.tests.test_path_containment tools.agents.tests.test_path_normalizer_hardened tools.agents.tests.test_sandbox_tool_strip tools.agents.tests.test_proxy_env_loader tools.agents.tests.test_stream_required_tool tools.agents.tests.test_tool_call_wrapper_profiles tools.agents.tests.test_tool_convert_cache tools.agents.tests.test_doubling_break tools.agents.tests.test_error_loop_ignores_correctives tools.agents.tests.test_anthropic_proxy_tool_arg_types tools.agents.tests.test_attractor_detection tools.agents.tests.test_client_disconnect tools.agents.tests.test_confidence_escalation tools.agents.tests.test_coordination_ban tools.agents.tests.test_coordination_early_ban tools.agents.tests.test_cycle_break_exploration tools.agents.tests.test_deferral_break tools.agents.tests.test_deliver_autoroute tools.agents.tests.test_delivery_enforcement_all_langs tools.agents.tests.test_delivery_enforcement_exemptions tools.agents.tests.test_delivery_enforcement_filepath tools.agents.tests.test_delivery_enforcement_write_complexity tools.agents.tests.test_fastpath_config tools.agents.tests.test_delivery_enforcement_web_and_bash tools.agents.tests.test_disconnect_watcher tools.agents.tests.test_empty_maxtokens_recovery tools.agents.tests.test_empty_tool_loop_break tools.agents.tests.test_enforcer_escape_hatches tools.agents.tests.test_error_loop_break tools.agents.tests.test_finalize_suppression tools.agents.tests.test_malformed_unclosed_think tools.agents.tests.test_mandate_beats_recon tools.agents.tests.test_mandate_deliver tools.agents.tests.test_overflow_truncate_count_tokens tools.agents.tests.test_passthrough_oauth tools.agents.tests.test_project_telemetry tools.agents.tests.test_proxy_auth_headers tools.agents.tests.test_prune_preserve_force_write tools.agents.tests.test_recon_deliver_gate tools.agents.tests.test_session_admission tools.agents.tests.test_stream_heartbeat tools.agents.tests.test_stuck_break_reattach tools.agents.tests.test_stuck_break_hard tools.agents.tests.test_turn_count_breaker_periodic tools.agents.tests.test_upstream_chokepoint tools.agents.tests.test_vision_passthrough tools.agents.tests.test_worktree_required tools.agents.tests.test_enforcer_suite_coverage tools.agents.tests.test_validate_plan_gate tools.agents.tests.test_validate_plan_inside_project tools.agents.tests.test_anthropic_proxy_streaming tools.agents.tests.test_non_stream_resp_log tools.agents.tests.test_delivery_enforcement_worktree tools.agents.tests.test_output_token_ceilings tools.agents.tests.test_tool_narrowing_core tools.agents.tests.test_models_context_window tools.agents.tests.test_thinking_template_kwargs tools.agents.tests.test_cycle_break_wait_poll tools.agents.tests.test_upstream_model_aliases tools.agents.tests.test_stream_thinking_deltas",
     "test:coverage": "vitest --coverage",
     "bench": "vitest --config vitest.bench.config.ts",
     "lint": "eslint src --ext .ts",

package/tools/agents/scripts/anthropic_proxy.py

@@ -6603,13 +6603,10 @@ def _maybe_inject_error_loop_break(openai_body: dict, monitor: "SessionMonitor")
     directive = (
         "\n\nSTOP — the SAME failure has now recurred "
         + str(monitor.error_signature_streak)
-        + " times in a row despite your edits: \""
+        + " times in a row: \""
         + monitor.last_error_signature[:120]
-        + "\". Your edits are NOT addressing the real cause. Do NOT make another "
-        "edit yet. FIRST re-read the ENTIRE failing file (and the full error "
-        "output) top-to-bottom — the bug is very likely somewhere you have not "
-        "looked (a duplicate declaration, a wrong import, a different file). "
-        "Only after you can name the exact line causing THIS error, fix that."
+        + "\". "
+        + _error_loop_remedy(monitor.last_error_signature)
     )
     if (
         PROXY_ERROR_LOOP_HARD_LIMIT > 0
@@ -6636,6 +6633,60 @@ def _maybe_inject_error_loop_break(openai_body: dict, monitor: "SessionMonitor")
     )
 
 
+def _error_loop_remedy(signature: str) -> str:
+    """Corrective advice matched to the failing signature.
+
+    2026-09-13. The generic remedy is "re-read the ENTIRE failing file", which
+    assumes the loop is a *code* bug. Many observed loops are TOOL MISUSE, where
+    that advice is not merely unhelpful but wrong — there is no failing file to
+    re-read, and the model duly repeats the identical bad call until the hard stop
+    ends the run. Observed live on Signal-3.8-27B + droid: `Read` invoked on a
+    directory x4, and a TodoWrite schema violation x4, each ending in a breaker.
+
+    Matching is on the normalised signature the monitor already computes (literals
+    are replaced by `#`/`<path>`), so these stay substring tests. Falls back to the
+    generic code-bug remedy when nothing matches.
+    """
+    sig = (signature or "").lower()
+
+    if "is a directory" in sig:
+        return (
+            "This is TOOL MISUSE, not a code bug: you called a file-reading tool "
+            "on a DIRECTORY. Do NOT retry it on the same path. To see what is "
+            "inside a directory use the directory-listing tool (LS) or a glob "
+            "search (Glob); use the file-reading tool only on a concrete FILE path."
+        )
+    if "does not exist" in sig or "no such file" in sig:
+        return (
+            "This is TOOL MISUSE, not a code bug: the path you passed does not "
+            "exist, so re-reading it cannot help. Do NOT retype the same path. "
+            "First LIST the parent directory (LS) or search for the file by name "
+            "(Glob/Grep), then use the exact path those results return."
+        )
+    if "must be" in sig and ("status" in sig or "enum" in sig or "one of" in sig):
+        return (
+            "This is a SCHEMA violation, not a code bug: one of your tool "
+            "arguments used a value or shape the tool does not accept. Re-read "
+            "that tool's parameter schema in the tool definition and emit the "
+            "arguments EXACTLY as declared — real JSON types (an array must be a "
+            "JSON array, not a string containing one), and only the permitted "
+            "enum values. If you cannot express it, skip the tool and continue."
+        )
+    if "required" in sig and ("property" in sig or "argument" in sig or "field" in sig):
+        return (
+            "This is a SCHEMA violation, not a code bug: a required argument is "
+            "missing. Re-read the tool's parameter schema and supply every "
+            "required field with its declared type."
+        )
+    return (
+        "Your edits are NOT addressing the real cause. Do NOT make another "
+        "edit yet. FIRST re-read the ENTIRE failing file (and the full error "
+        "output) top-to-bottom — the bug is very likely somewhere you have not "
+        "looked (a duplicate declaration, a wrong import, a different file). "
+        "Only after you can name the exact line causing THIS error, fix that."
+    )
+
+
 def _maybe_inject_doubling_break(openai_body: dict, monitor: "SessionMonitor") -> None:
     """Break a doubling-down run: the SAME tool call has failed N times in a row.
 
@@ -9465,6 +9516,182 @@ def _default_required_value(field_name: str, field_schema: dict):
     return _MISSING_REQUIRED_VALUE
 
 
+def _declared_json_types(field_schema: dict) -> set[str]:
+    """JSON Schema `type` for one property, normalised to a set.
+
+    Handles the scalar form ("array"), the list form (["array", "null"]) and the
+    anyOf/oneOf union form, so a nullable or unioned field is not mistaken for an
+    untyped one. Returns an empty set when the schema declares no type at all —
+    callers must treat that as "unknown, do not coerce".
+    """
+    if not isinstance(field_schema, dict):
+        return set()
+    out: set[str] = set()
+    raw = field_schema.get("type")
+    if isinstance(raw, str):
+        out.add(raw)
+    elif isinstance(raw, list):
+        out.update(t for t in raw if isinstance(t, str))
+    for union_key in ("anyOf", "oneOf"):
+        for sub in field_schema.get(union_key) or []:
+            out |= _declared_json_types(sub)
+    return out
+
+
+def _coerce_to_declared_type(value, declared: set[str]):
+    """Return a type-corrected `value`, or `_MISSING_REQUIRED_VALUE` if no safe fix.
+
+    Deliberately conservative: a coercion is applied ONLY when the corrected
+    value's own JSON type is one the schema actually declares. Anything
+    ambiguous is left untouched for the existing preflight/retry path.
+    """
+    if not declared:
+        return _MISSING_REQUIRED_VALUE
+    if not isinstance(value, str):
+        return _MISSING_REQUIRED_VALUE
+    text = value.strip()
+    if not text:
+        return _MISSING_REQUIRED_VALUE
+
+    # The dominant local-model defect: a nested array/object emitted as a
+    # *stringified* JSON blob (double-encoded) instead of real JSON.
+    if ("array" in declared or "object" in declared) and text[0] in "[{":
+        try:
+            parsed = json.loads(text)
+        except (json.JSONDecodeError, ValueError):
+            return _MISSING_REQUIRED_VALUE
+        if isinstance(parsed, list) and "array" in declared:
+            return parsed
+        if isinstance(parsed, dict) and "object" in declared:
+            return parsed
+        return _MISSING_REQUIRED_VALUE
+
+    # Scalars arriving quoted. Guarded so "1.5" never silently becomes an int and
+    # a numeric string stays a string when the schema really wants a string.
+    if "string" in declared:
+        return _MISSING_REQUIRED_VALUE
+    if "boolean" in declared and text.lower() in {"true", "false"}:
+        return text.lower() == "true"
+    if "integer" in declared:
+        try:
+            return int(text)
+        except ValueError:
+            pass
+    if "number" in declared:
+        try:
+            return float(text)
+        except ValueError:
+            pass
+    return _MISSING_REQUIRED_VALUE
+
+
+def _repair_tool_arg_types(
+    openai_resp: dict, anthropic_body: dict
+) -> tuple[dict, int]:
+    """Coerce tool arguments whose JSON type contradicts the declared schema.
+
+    2026-09-13. The preflight guard (`_validate_tool_call_arguments`) only checks
+    that `arguments` parses as JSON and is an object — it never compares property
+    types against the schema. So a double-encoded argument passes validation
+    unflagged, reaches the client broken, and no retry hint ever fires; the model
+    then repeats the identical malformed call until the ERROR-LOOP guard hard-stops
+    the run.
+
+    Measured on Signal-3.8-27B + droid: **120/120** TodoWrite payloads over four
+    days emitted `todos` as a *string* rather than an array, e.g.
+
+        {"todos": "[{\"content\": \"...\", \"status\": \"pending\"}]"}
+
+    which droid rejects ("todo item #: status must be ..."), giving a 0% success
+    rate on that tool. This repairs the encoding at the proxy so the call lands
+    valid. It is a TYPE fix only — it cannot invent a correct inner schema, so a
+    payload whose nested objects use the wrong KEYS still fails downstream (that
+    case is bounded by the coordination-tool ban instead).
+
+    Conservative by construction: a value is rewritten only when the declared type
+    is known and the corrected value matches it, so a tool that legitimately takes
+    a JSON string is never touched.
+    """
+    if not _openai_has_tool_calls(openai_resp):
+        return openai_resp, 0
+
+    tools_by_name = _anthropic_tools_by_name(anthropic_body)
+    if not tools_by_name:
+        return openai_resp, 0
+
+    choice, message = _extract_openai_choice(openai_resp)
+    tool_calls = message.get("tool_calls") or []
+    if not tool_calls:
+        return openai_resp, 0
+
+    repaired_tool_calls = []
+    repaired_count = 0
+
+    for tool_call in tool_calls:
+        fn = tool_call.get("function") if isinstance(tool_call, dict) else {}
+        if not isinstance(fn, dict):
+            fn = {}
+        tool_name = fn.get("name", "")
+        schema = tools_by_name.get(tool_name) or {}
+        properties = schema.get("properties") if isinstance(schema, dict) else {}
+        if not isinstance(properties, dict) or not properties:
+            repaired_tool_calls.append(tool_call)
+            continue
+
+        raw_args = fn.get("arguments", "{}")
+        if isinstance(raw_args, dict):
+            parsed_args = dict(raw_args)
+        else:
+            try:
+                parsed_args = json.loads(str(raw_args))
+            except (json.JSONDecodeError, ValueError):
+                repaired_tool_calls.append(tool_call)
+                continue
+        if not isinstance(parsed_args, dict):
+            repaired_tool_calls.append(tool_call)
+            continue
+
+        fixed_fields = []
+        for field, value in list(parsed_args.items()):
+            declared = _declared_json_types(properties.get(field, {}))
+            coerced = _coerce_to_declared_type(value, declared)
+            if coerced is _MISSING_REQUIRED_VALUE:
+                continue
+            parsed_args[field] = coerced
+            fixed_fields.append(field)
+
+        if not fixed_fields:
+            repaired_tool_calls.append(tool_call)
+            continue
+
+        new_tool_call = dict(tool_call)
+        new_fn = dict(fn)
+        new_fn["arguments"] = json.dumps(parsed_args, separators=(",", ":"))
+        new_tool_call["function"] = new_fn
+        repaired_tool_calls.append(new_tool_call)
+        repaired_count += 1
+        logger.warning(
+            "TOOL ARG TYPE REPAIR: '%s' fields=%s coerced to declared schema types",
+            tool_name,
+            fixed_fields,
+        )
+
+    if repaired_count == 0:
+        return openai_resp, 0
+
+    choices = list(openai_resp.get("choices") or [])
+    if not choices:
+        return openai_resp, 0
+    repaired_response = dict(openai_resp)
+    updated_choice = dict(choice)
+    updated_message = dict(message)
+    updated_message["tool_calls"] = repaired_tool_calls
+    updated_choice["message"] = updated_message
+    choices[0] = updated_choice
+    repaired_response["choices"] = choices
+    return repaired_response, repaired_count
+
+
 def _repair_required_tool_args(
     openai_resp: dict, anthropic_body: dict
 ) -> tuple[dict, int]:
@@ -10610,12 +10837,24 @@ async def _apply_malformed_tool_guardrail(
     repair_count = 0
     if PROXY_TOOL_ARGS_PREFLIGHT and _openai_has_tool_calls(openai_resp):
         working_resp, markup_repairs = _repair_tool_call_markup(openai_resp)
+        # Type coercion runs BEFORE required-arg filling: a double-encoded value
+        # is *present* (just wrongly typed), so _repair_required_tool_args would
+        # leave it alone, and the preflight below never type-checks it at all.
+        working_resp, type_repairs = _repair_tool_arg_types(
+            working_resp, anthropic_body
+        )
         working_resp, required_repairs = _repair_required_tool_args(
             working_resp, anthropic_body
         )
         working_resp, bash_repairs = _repair_bash_command_artifacts(working_resp)
         working_resp, leak_repairs = _repair_system_prompt_leak(working_resp)
-        repair_count = markup_repairs + required_repairs + bash_repairs + leak_repairs
+        repair_count = (
+            markup_repairs
+            + type_repairs
+            + required_repairs
+            + bash_repairs
+            + leak_repairs
+        )
 
     required_tool_choice = openai_body.get("tool_choice") == "required"
     has_tool_calls = _openai_has_tool_calls(working_resp)

package/tools/agents/tests/test_anthropic_proxy_tool_arg_types.py

@@ -0,0 +1,234 @@
+#!/usr/bin/env python3
+"""Tool-argument type coercion + signature-aware ERROR-LOOP remedies.
+
+Regression cover for the 2026-09-13 droid loop: the preflight guard validated
+only that `arguments` parsed as JSON and was an object, so a double-encoded
+argument reached the client broken and the model repeated the identical bad
+call until the ERROR-LOOP hard stop killed the run.
+
+Payloads here are verbatim from the live proxy journal.
+"""
+
+import importlib.util
+import json
+import unittest
+from pathlib import Path
+
+
+def _load_proxy_module():
+    proxy_path = Path(__file__).resolve().parents[1] / "scripts" / "anthropic_proxy.py"
+    spec = importlib.util.spec_from_file_location("anthropic_proxy", proxy_path)
+    assert spec is not None and spec.loader is not None
+    module = importlib.util.module_from_spec(spec)
+    spec.loader.exec_module(module)
+    return module
+
+
+proxy = _load_proxy_module()
+
+TODO_SCHEMA = {
+    "name": "TodoWrite",
+    "input_schema": {
+        "type": "object",
+        "properties": {
+            "todos": {
+                "type": "array",
+                "items": {
+                    "type": "object",
+                    "properties": {
+                        "content": {"type": "string"},
+                        "status": {
+                            "type": "string",
+                            "enum": ["pending", "in_progress", "completed"],
+                        },
+                    },
+                },
+            }
+        },
+        "required": ["todos"],
+    },
+}
+
+
+def _resp(tool_name, arguments):
+    return {
+        "choices": [
+            {
+                "message": {
+                    "role": "assistant",
+                    "tool_calls": [
+                        {
+                            "id": "call_1",
+                            "type": "function",
+                            "function": {"name": tool_name, "arguments": arguments},
+                        }
+                    ],
+                }
+            }
+        ]
+    }
+
+
+def _args_of(resp):
+    fn = resp["choices"][0]["message"]["tool_calls"][0]["function"]
+    return json.loads(fn["arguments"])
+
+
+class TestToolArgTypeRepair(unittest.TestCase):
+    def test_stringified_array_is_parsed_into_a_real_array(self):
+        """The live defect: 120/120 TodoWrite payloads sent `todos` as a string."""
+        inner = [{"content": "Set up worktree", "status": "in_progress"}]
+        resp = _resp("TodoWrite", json.dumps({"todos": json.dumps(inner)}))
+        out, n = proxy._repair_tool_arg_types(resp, {"tools": [TODO_SCHEMA]})
+        self.assertEqual(n, 1)
+        self.assertEqual(_args_of(out)["todos"], inner)
+
+    def test_already_valid_array_is_left_untouched(self):
+        inner = [{"content": "x", "status": "pending"}]
+        resp = _resp("TodoWrite", json.dumps({"todos": inner}))
+        out, n = proxy._repair_tool_arg_types(resp, {"tools": [TODO_SCHEMA]})
+        self.assertEqual(n, 0)
+        self.assertEqual(_args_of(out)["todos"], inner)
+
+    def test_a_string_typed_field_is_never_coerced(self):
+        """A tool that legitimately takes JSON-in-a-string must not be rewritten."""
+        schema = {
+            "name": "Run",
+            "input_schema": {
+                "type": "object",
+                "properties": {"payload": {"type": "string"}},
+            },
+        }
+        resp = _resp("Run", json.dumps({"payload": '[{"a": 1}]'}))
+        out, n = proxy._repair_tool_arg_types(resp, {"tools": [schema]})
+        self.assertEqual(n, 0)
+        self.assertEqual(_args_of(out)["payload"], '[{"a": 1}]')
+
+    def test_unparseable_string_is_left_for_the_retry_path(self):
+        resp = _resp("TodoWrite", json.dumps({"todos": "[{not json"}))
+        out, n = proxy._repair_tool_arg_types(resp, {"tools": [TODO_SCHEMA]})
+        self.assertEqual(n, 0)
+
+    def test_object_string_coerced_only_when_object_is_declared(self):
+        schema = {
+            "name": "Cfg",
+            "input_schema": {
+                "type": "object",
+                "properties": {"opts": {"type": "object"}},
+            },
+        }
+        resp = _resp("Cfg", json.dumps({"opts": '{"a": 1}'}))
+        out, n = proxy._repair_tool_arg_types(resp, {"tools": [schema]})
+        self.assertEqual(n, 1)
+        self.assertEqual(_args_of(out)["opts"], {"a": 1})
+
+    def test_array_declared_but_object_string_supplied_is_not_coerced(self):
+        """Type must match what the schema declares — never force a shape."""
+        resp = _resp("TodoWrite", json.dumps({"todos": '{"a": 1}'}))
+        out, n = proxy._repair_tool_arg_types(resp, {"tools": [TODO_SCHEMA]})
+        self.assertEqual(n, 0)
+
+    def test_nullable_union_type_still_coerces(self):
+        schema = {
+            "name": "T",
+            "input_schema": {
+                "type": "object",
+                "properties": {"items": {"type": ["array", "null"]}},
+            },
+        }
+        resp = _resp("T", json.dumps({"items": "[1,2]"}))
+        out, n = proxy._repair_tool_arg_types(resp, {"tools": [schema]})
+        self.assertEqual(n, 1)
+        self.assertEqual(_args_of(out)["items"], [1, 2])
+
+    def test_quoted_scalars_coerced_to_declared_scalar_types(self):
+        schema = {
+            "name": "N",
+            "input_schema": {
+                "type": "object",
+                "properties": {
+                    "limit": {"type": "integer"},
+                    "ratio": {"type": "number"},
+                    "deep": {"type": "boolean"},
+                },
+            },
+        }
+        resp = _resp("N", json.dumps({"limit": "10", "ratio": "1.5", "deep": "true"}))
+        out, n = proxy._repair_tool_arg_types(resp, {"tools": [schema]})
+        self.assertEqual(n, 1)
+        self.assertEqual(_args_of(out), {"limit": 10, "ratio": 1.5, "deep": True})
+
+    def test_untyped_property_is_left_alone(self):
+        schema = {
+            "name": "U",
+            "input_schema": {"type": "object", "properties": {"blob": {}}},
+        }
+        resp = _resp("U", json.dumps({"blob": "[1,2]"}))
+        out, n = proxy._repair_tool_arg_types(resp, {"tools": [schema]})
+        self.assertEqual(n, 0)
+
+    def test_unknown_tool_and_no_tool_calls_are_no_ops(self):
+        resp = _resp("Mystery", json.dumps({"todos": "[]"}))
+        _, n = proxy._repair_tool_arg_types(resp, {"tools": [TODO_SCHEMA]})
+        self.assertEqual(n, 0)
+        _, n2 = proxy._repair_tool_arg_types({"choices": []}, {"tools": [TODO_SCHEMA]})
+        self.assertEqual(n2, 0)
+
+
+class TestErrorLoopRemedy(unittest.TestCase):
+    def test_directory_misuse_does_not_advise_rereading_a_file(self):
+        r = proxy._error_loop_remedy('error: error: path "<path> is a directory.')
+        self.assertIn("TOOL MISUSE", r)
+        self.assertIn("LS", r)
+        self.assertNotIn("re-read the ENTIRE failing file", r)
+
+    def test_missing_path_advises_listing_not_retyping(self):
+        r = proxy._error_loop_remedy("error: path does not exist: <path>")
+        self.assertIn("TOOL MISUSE", r)
+        self.assertIn("Glob", r)
+
+    def test_enum_violation_advises_schema_not_code(self):
+        r = proxy._error_loop_remedy(
+            "error: todo item #: status must be pending, in_progress, or completed"
+        )
+        self.assertIn("SCHEMA violation", r)
+        self.assertNotIn("re-read the ENTIRE failing file", r)
+
+    def test_genuine_code_error_keeps_the_generic_remedy(self):
+        r = proxy._error_loop_remedy("error: command failed (exit code: #)")
+        self.assertIn("re-read the ENTIRE failing file", r)
+
+    def test_empty_signature_is_safe(self):
+        self.assertIn("re-read the ENTIRE failing file", proxy._error_loop_remedy(""))
+
+
+class TestRepairIsWiredIntoTheGuardrailPipeline(unittest.TestCase):
+    """Unit-testing the repair function alone would not catch a wiring mistake.
+
+    This drives the real `_apply_malformed_tool_guardrail` chain — the code path a
+    live response actually takes — so the test fails if the repair is ever dropped
+    from it or ordered after the preflight that consumes its output.
+    """
+
+    def test_double_encoded_arg_is_fixed_through_the_real_chain(self):
+        import asyncio
+
+        inner = [{"content": "Set up worktree", "status": "in_progress"}]
+        resp = _resp("TodoWrite", json.dumps({"todos": json.dumps(inner)}))
+        monitor = proxy.SessionMonitor()
+        out = asyncio.run(
+            proxy._apply_malformed_tool_guardrail(
+                None,
+                resp,
+                {"tool_choice": "auto"},
+                {"tools": [TODO_SCHEMA]},
+                monitor,
+                "sess-test",
+            )
+        )
+        self.assertEqual(_args_of(out)["todos"], inner)
+
+
+
+if __name__ == "__main__":
+    unittest.main()